Summary

vke_attach() declares struct tapinfo tapinfo; on its stack (line 771) and only initializes it via ioctl(TAPGIFINFO) inside the narrow branch if (!info->enaddr && info->tap_unit >= 0) (line 794). In all other cases — notably when a MAC address is supplied via -I (info->enaddr != NULL, which skips the entire else block at line 779) OR when the backend is a vknet unix socket (info->tap_unit == -1, see init.c:1047/1103-1108) — the ioctl is never called, yet line 866-867 unconditionally reads tapinfo.mtu and tapinfo.baudrate and assigns them to ifp->if_mtu and ifp->if_baudrate. The garbage values are then world-readable inside the guest via ifconfig/sysctl.

Root cause

vke_attach at if_vke.c:771:

struct tapinfo tapinfo;      /* no initializer */

The initialization branch at line 794 if (info->tap_unit >= 0) { if (ioctl(fd, TAPGIFINFO, &tapinfo) < 0) ... } is the only place tapinfo is touched. The unconditional consumers at:

ifp->if_mtu = tapinfo.mtu;           /* line 866 */
ifp->if_baudrate = tapinfo.baudrate; /* line 867 */

execute regardless. struct tapinfo (sys/net/tap/if_tap.h:46-51) is {int baudrate; short mtu; u_char type; u_char dummy;} — 8 bytes of uninitialized stack become observable.

Compounding: ifp->if_mtu (int) gets sign-extended from a short, potentially yielding a huge/negative MTU that propagates into route metrics and IP fragmentation decisions for the life of the interface.

Threat model

Attacker position: any unprivileged guest user process inside the vkernel, post-boot. The guest reads ifp->if_mtu / ifp->if_baudrate via ifconfig vkeN or sysctl (net.interfaces).

It recovers 6 bytes of deterministic-per-boot vke_attach stack residue (function pointers / return addresses from the SYSINIT boot path), which can seed KASLR-defeating or ROP-priming information for a second-stage bug.

No privileges required beyond being able to read interface state. Reachability is default: every vkernel started with a MAC on the -I line, and every vkernel using a vknet socket backend (info->tap_unit<0), hits this path.

Secondary impact is a corrupted ifp->if_mtu that can mis-size protocol buffers and confuse fragmentation for the entire vke interface lifetime.

PoC

Build in userland inside a vkernel guest:

1. Start a vkernel supplying a MAC address: vkernel64 -I vke0:00:11:22:33:44:55:bridge0 ... (the : after the MAC sets info->enaddr non-NULL via init.c:1357-1366, skipping the ioctl). OR start with a unix-socket backend /var/run/vknet which yields info->tap_unit = -1.

2. Inside the guest, as an unprivileged user, run: ifconfig vke0 and observe the mtu and baudrate fields. The mtu field will be a garbage value (e.g. mtu -29891 or similar) instead of the expected 1500.

Save the value; it is a deterministic 6-byte snapshot of the vkernel boot-time stack. Repeatable across ifconfig calls within the same boot (constant); changes only across reboots if stack layout changes.

Success criterion: mtu != 1500 and mtu is not a sane Ethernet value. No panic; the leak is silent.

Recommended fix

Initialize tapinfo at declaration or only assign ifp fields when the ioctl actually ran.

--- a/sys/dev/virtual/vkernel/net/if_vke.c
+++ b/sys/dev/virtual/vkernel/net/if_vke.c
@@ -768,7 +768,7 @@ vke_attach(const struct vknetif_info *info, int unit)
    struct vke_softc *sc;
    struct ifnet *ifp;
-   struct tapinfo tapinfo;
+   struct tapinfo tapinfo = { 0 };
    uint8_t enaddr[ETHER_ADDR_LEN];
    int nmbufs;
    int fd;
@@ -864,8 +864,16 @@ vke_attach(const struct vknetif_info *info, int unit)
    ifp->if_ioctl = vke_ioctl;
    ifp->if_start = vke_start;
    ifp->if_init = vke_init;
-   ifp->if_mtu = tapinfo.mtu;
-   ifp->if_baudrate = tapinfo.baudrate;
+   /*
+    * Only propagate mtu/baudrate from the TAP backend when we actually
+    * queried them.  For unix-socket backends (tap_unit < 0) or when a
+    * MAC was supplied on the command line, ioctl(TAPGIFINFO) was never
+    * run and tapinfo would leak uninitialized stack into the ifnet.
+    */
+   if (info->tap_unit >= 0) {
+       ifp->if_mtu = tapinfo.mtu;
+       ifp->if_baudrate = tapinfo.baudrate;
+   }
    ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
    ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
    ifq_set_ready(&ifp->if_snd);

This both prevents the info leak and leaves sane defaults (if_mtu=ETHERMTU set later by ether_ifattach at line 936) for socket/MAC-supplied backends.